Network system enabling transmission control

ABSTRACT

A network system capable of preventing the leakage of a confidential file by an inadvertent act of a transmitting party and capable of meeting the requirement for an arbitrary file format is disclosed. A label indicating a security level (“confidential” or “unclassified”) is attached to the file in a client terminal, which transmits the labeled file outside. A transmission management program on a gateway server checks the label of the file, and in the case where the security level is “unclassified”, transmits the file to an external network. Also, a label management program manages the labeled file in the client terminal.

BACKGROUND OF THE INVENTION

The present invention relates to a technique for preventing theconfidential information handled in an organization or the like fromleaking outside.

The electronic data handled in an organization or the like contain lotsof confidential information. On these electronic data, the word“confidential” is written in the documents intentionally to inform theviewers that the particular data are confidential. The confidential dataare thus prevented from leaking outside by making the viewers consciousof the importance of leaking the data outside. Sometimes, however, theconfidential data may be inadvertently or intentionally transmittedoutside by mail. To cope with this problem, the server searches the mailcontents using a keyword to check whether a preset keyword(“confidential”, for example) is contained in the mail. In the casewhere the keyword is not contained in the mail, the mails aretransmitted as they are while in the case where the keyword is containedin the mail, the transmission is suspended.

Some confidential information can be accessed only by executives of anorganization. In order to prevent the confidential information frombeing accessed by unauthorized personnel, the information flow can becontrolled to make the particular confidential information inaccessiblefrom other than the executives by attaching a forcible access controlfunction.

For detailed information on the forcible access control, refer to thereference (TCSEC) “Department of Defense Trusted Computer SystemEvaluation Criteria” DOD 5200.28-STD.

On the other hand, U.S. Pat. No. 5,940,591 discloses a technique forrealizing a multi-level security in the network environment.

Also, JP-A-8-204701 discloses a method of preventing the confidentialinformation from leaking to third parties by transmitting theinformation in encrypted form.

The system for preventing the information leakage based on the keywordsearch is effective for specified data formats, but not effective forother data formats and an image file containing no text information.

In a computer equipped with the mandatory access control function, theinformation flow can be controlled sufficiently as long as the data staywithin the particular computer. Once the data transfers to anothercomputer, however, the security level of the data, which is dependent onthe transferee computer, cannot be easily guaranteed. Also, the computerhaving the mandatory access control function is often utilized forspecial applications and unable to be used for general-purposeapplications. The use of such computer, therefore, hardly extends tounclassified companies and organization.

U.S. Pat. No. 5,940,591 described above poses such problems as: (1) theaccess control is provided for each user but not for each file, and (2)the requirement for making inquiry at a security manager each time oftransmission results in a heavy load.

In the case where data are transmitted in encrypted form, on the otherhand, the data are encrypted at an employee's terminal, and thereforethe employee is required to be informed which data is confidential. As aresult, the confidential data may be inadvertently transmitted withoutbeing encrypted.

SUMMARY OF THE INVENTION

The present invention provides a technique for preventing theconfidential information of an organization from being transmittedinadvertently by an employee in charge of data transmission.

The invention further provides a system capable of using the techniquedescribed above with an arbitrary data format.

The invention further provides a technique whereby the security level(“confidential” or “unclassified”) of data is maintained in the datatransfer within an organization and is usable for an arbitrary dataformat.

Specifically, additional information indicating the attribute of theinformation proper (data body) is attached to the information proper(data body), and the transmission and receipt of the information properare controlled using the particular additional information.

More specifically, a label (additional information) indicating theattribute is attached to each data body (information proper), so thatthe data with the label are handled within the organization. Theattribute includes a security level (“confidential” or “unclassified”),for example. In the case where the data are transmitted outside, thislabel is checked by a transmission control program on a gateway server,which decides whether the data can be transmitted outside or not, and inthe case where the data is transmissible outside, removes the label fromthe data and transmits the data body outside. On the other hand, thegateway server that has received a data body from outside attaches alabel to the data body and transmits the data to the address in theorganization.

At a terminal used by a user, a label may not be attached directly onthe data body but the security level information of each data may bewritten in another file. In the case where the data body is transmittedfrom a client terminal, a label indicating the security level of thedata body is attached by referring to the file and the labeled data istransmitted.

By attaching a signature to the label, the chance of illegal alterationof the label is reduced while at the same time making it possible toidentify the party who has set the security level.

According to the invention, there is also provided a technique forpreventing the illegal alteration or destruction of the label by the bugof an application program or a device driver or the operating error onthe part of the user. Specifically, a multi OS (operating system)control technique is used to execute two operating systems in such amanner that one operating system is made available for use by the userwhile the other operating system is exclusively used for labelmanagement.

According to this invention, as compared with the US patent describedabove, (1) the access to each data can be controlled by an accesscontrol list, and (2) since the access control list is located withineach user terminal, no inquiry is required each time.

Other objects, features and advantages of the invention will becomeapparent from the following description of the embodiments of theinvention taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram showing the whole network system according to theinvention.

FIG. 2 is a diagram showing a label format.

FIG. 3 is a flowchart for performing of opening a file.

FIG. 4 is a diagram showing a process management list.

FIG. 5 is a flowchart for performing the process of reading from a file.

FIG. 6 is a flowchart for performing the process of writing into a file.

FIG. 7 is a flowchart for performing the process of writing a file intoremovable media.

FIG. 8 is a flowchart for performing the process of reading a file fromremovable media.

FIG. 9 is a flowchart for performing the process of transmitting a fileonto a network.

FIG. 10 is a flowchart for performing the process of changing thesecurity level.

FIG. 11 is a flowchart for performing the process of checking the labelat a gateway server.

FIG. 12 is a diagram showing a format of a security level control list.

FIG. 13 is a flowchart for performing the process of writing a file intoremovable media according to a second embodiment of the invention.

FIG. 14 is a diagram showing a structure of a labeled file according toa third embodiment of the invention.

FIG. 15 is a flowchart for performing the process of writing into a fileaccording to the third embodiment of the invention.

FIG. 16 is a flowchart for performing the process of receiving a file ata client terminal.

FIG. 17 is a flowchart for performing the process of checking the labelat a gateway server according to the third embodiment of the invention.

FIG. 18 is a diagram showing a configuration of a client terminal of anetwork system according to this invention using two operating systems.

DESCRIPTION OF THE EMBODIMENTS

The disclosures of all articles and references, including patentdocuments, mentioned in the application are incorporated herein byreference for all purposes.

First Embodiment

A first embodiment of the invention will be explained. According to thisembodiment, a label indicating a security level is attached to the headof the data stored in a file. The information flow is controlled usingthis label information. The contents and the number of the securitylevel and the number of level can be set freely for each system. Thedescription that follows refers to two levels including “confidential”and “unclassified”. This label may or may not be attached to a filedepending on the type of the file. No label is attached to the systemfile and the driver file, for example, while the label is attached to anapplication data file. The manner in which a file with no label attachedthereto is determined in advance as a system policy. According to thisembodiment, any files with no label attached thereto are handled as“unclassified” data at a client terminal.

FIG. 1 shows an example of a configuration of the system according tothis embodiment. At least one client terminal 101, a gateway server 118and a key management server 114 are connected to an in-house network117. Further, the gateway server 118 is connected to an external network121. The client terminal 101 includes a CPU 113, a memory 102, amagnetic disk 106, a network I/F 112 and an external storage unit 122.The memory 102 has loaded thereon a label management program 109, a filesystem driver 104, a disk driver 105, a protocol driver 110, a networkadaptor driver 111, an application program 103 and a security levelchange program 108. Each of these programs is operated under the controlof an operating system (OS).

A plurality of files 107 are stored in the magnetic disk 106. Theexternal storage unit 122 is a device for reading or writing data fromor into the file 124 in removable storage media (hereinafter referred toas removable media) 123. The external storage unit includes, forexample, a floppy disk drive or a CD-ROM device. A transmissionmanagement program 119 and a receiving management program 120 areoperating in the gateway server 118. The key management server 114includes key information 116 and has a key management program 115operating therein. The client terminal 101 transmits a labeled file ontothe network, and the gateway server 118 checks the label of the labeledfile to determine whether the particular labeled file should betransmitted or not outside.

Each program in each embodiment may be introduced into the memory 102from the magnetic disk 106, the removable media, or other serversconnected to a network in or outside an organization.

FIG. 2 shows an example of a label format according to this embodiment.The label is located at the head of the file 107 and has information of32 bits (4 bytes). Of the 32 bits, the first two bits represents theversion information 201 for the label format, the next three bits thesecurity level 202 of the filed 107, the following next three bits thesettlor level 203 for setting the security level of the file 107, andthe remaining 24 bits the settlor ID 204 who has set the security levelof the file 107. The security level 202 includes “unclassified” and“confidential”, and the settlor level 203 includes, for example,“employee”, “group leader”, “section manager” and “department manager”.The format and the size of the label may be varied from one organizationto another depending on the number of the security levels 202, the sizeof the organization or other information to be added. The otherinformation includes, for example, the term of validity of the label,the information on the person who has generated the file 107 and theaccess control information (the read-only information, etc.). The accesscan be controlled using various information other than the securitylevel 202.

The label management program 109 is for managing the label of the file107. In the case where the application program 103 accesses the file107, the label is removed and data (data body) other than the label isdelivered to the application program 103. In the case where theapplication program 103 transmits the file 107 to the in-house network117 through the network I/F 112, on the other hand, the label managementprogram 109 transmits the file 107 with the label.

FIG. 3 is a flowchart for performing the process of opening the file 107located on the magnetic disk 106. “To open the file” is a pre-processmaking possible the operations including the reading of data in the fileor the writing of data in the file.

In step 301, the application program 103 issues a request for openingthe file 107 to the label management program 109 through the I/O managerof the operating system.

In step 302, the label management program 109 acquires the process ID ofthe application program 103 through the I/O manager. The process is aunit of executing a program managed by the operating system and theprocess ID is defined as an identifier of the process.

In step 303, the label management program 109 checks the security level202 of the file 107. In the case where no label is attached to the file107, the particular file 107 is determined as an “unclassified” file.Examples lacking the label are a system file and a driver file.

In step 304, the label management program 109 checks the security levelof the application program 103 from the process ID. The label managementprogram 109 checks the security level of the application program 103 byreferring to the process management list 400 shown in FIG. 4. As of thetime point when the file 107 is not yet opened by the applicationprogram 103, the security level of the application program 103 is notyet set.

The requirements for the security level (the security level of theprocess in execution) of the application program are as follows.Specifically, the application program 103 itself can handle files ofvarious security levels. In the case where confidential files andunclassified files are handled at the same time, the confidentialinformation may be written in an unclassified file (such as cut andpaste). According to this embodiment, this risk is avoided by utilizingthe security level of the process.

FIG. 4 shows a process management list 400. The first column shows theprocess ID 401, the second column the security level 402 of theparticular process (security level of the application program), thethird column the name 403 of the file opened, and the fourth column thesecurity level 404 of the particular file 107. The process managementlist 400 is prepared and initialized by a label management program 109at the time of loading the label management program 109. Also, the labelmanagement list 400 is updated by the label management program 109.

In step 305, the label management program 109 checks whether thesecurity level 402 of the application program 103 has been set or not,and in the case where it has been set, the process proceeds to step 311,otherwise the process is passed to step 306.

In step 306, the label management program 109 adds the process ID of theapplication program 103 to the process management list 400.

In step 307, the label management program 109 sets the process securitylevel 402 of the application program 103 to the security level 202 ofthe file 107.

In step 308, the label management program 109 adds the file name 403 andthe security level 202 of the particular file 107 to the processmanagement list 400.

In step 309, the label management program 109 transmits a request to thefile system driver 104 to pen the file 107.

In step 310, the file is successfully opened.

In step 311, the label management program 109 checks whether thesecurity level 402 of the application program 103 is coincident with thesecurity level 202 of the file 107. In the case where they arecoincident, the process proceeds to step 308, otherwise the processproceeds to step 312.

In step 312, the label management program 109 displays a message forcausing the user to determine whether the file 107 is really to beopened or not.

In step 313, the user decides whether the file 107 is opened or not. Inthe case where the user decides to open the file 107, the processproceeds to step 314, while in the case where the user decides not toopen the file 107, the process proceeds to step 315.

In step 314, the label management program 109 checks whether thesecurity level 402 of the application program 103 is higher than thesecurity level 202 of the file 107. In the case where the security level402 of the application program 103 is higher, the process proceeds tostep 308, otherwise the process proceeds to step 307.

In step 315, the label management program 109 transmits the open errormessage of the file 107 to the application program 103.

In step 316, the file fails to be open.

According to this embodiment, the application program 103 can alwaysopen the file 107 depending on the designation by the user. In the casewhere the security level 402 of the application program 103 is notcoincident with the security level 202 of the file 107 in step 311 ofFIG. 3, however, the process may proceed to step 315 thereby to forciblyreject the file open request.

Also, at the time of preparing a new file, the user selects the securitylevel 202 of the same file. In the standard setting, the security level202 of the file is set equal to the security level 402 of theapplication program 103. In the case where the security level 402 of theapplication program 103 is “not yet set”, on the other hand, the highest“confidential” level is desirably selected.

FIG. 5 is a flowchart for performing the process of reading data fromthe file 107 according to this embodiment. In this case, an explanationwill be made about a case in which the application program 103 reads thebyte offset 0X AB00 providing an address from the head of the file 107,where 0X indicates a hexadecimal notation.

In step 501, the application program 103 issues a request to read thedata from the byte offset 0X AB00 of the file 107.

In step 502, the label management program 103 converts the byte offset0X AB00 to the actual byte offset 0X AB04. According to this embodiment,the file 107 carries the information (label) of four bytes (32bits) atthe head of the file 107. Since the application program 103 is notinformed of the presence of the label, however, the byte offset whichthe application program 103 requests to read is required to be adjusted.As a result, according to this embodiment, a value obtained by addingfour bytes, i.e. the byte length of the label information to the byteoffset requested by the application program 103 constitutes the actualbyte offset.

In step 503, the file system driver 104 converts the actual byte offset0X AB04 to the relative position on the magnetic disk 106.

In step 504, the disk driver 105 converts the relative position of themagnetic disk 106 to a physical position and reads the data into thememory 102.

FIG. 6 is a flowchart for performing the process of writing the data inthe file 107 according to this embodiment. As an example, an explanationwill be made about a case in which the application program 103 writesinto a specific byte offset 0X AB00 of the file.

In step 601, the application program 103 issues a request to write thedata in the byte offset 0X AB00 of the file 107.

In step 602, the label management program 109 checks the security level402 of the application program 103 and the security level 202 of thefile 107.

In step 603, the label management program 109 checks whether thesecurity level of the application program 103 is coincident with that ofthe file 107. In the case where they are coincident with each other, theprocess proceeds to step 605, otherwise the process proceeds to step604.

In step 605, the label management program 109 converts the byte offset0X AB00 to the actual byte offset 0X AB04. As in the case where theapplication program 103 reads the data of the file 107 as describedabove, a value obtained by adding four bytes to the byte offsetrequested by the application program 103 constitutes an actual byteoffset.

In step 606, the file system driver 104 converts the actual byte offset0X AB04 to the relative position on the magnetic disk 106.

In step 607, the disk driver 105 converts the relative position on themagnetic disk 106 to a physical position and transfers the data to themagnetic disk 106.

In step 604, the label management program 109 changes the security level202 of the file 107 to the security level 402 of the application program103, and further changes the settlor level 203 and the settlor ID 204,followed by proceeding to step 605. According to this embodiment, thesecurity level 202 of the file 107 is changed to the security level 402of the application program 103 forcibly in step 604. As an alternative,however, a message may be displayed to permit the user to select thesecurity level 202 of the file 107.

According to this embodiment, the external storage unit 122 is arrangedat the client terminal 101, so that the data can be transferred toanother terminal using the removable media 123. As a result, theinformation is liable to leak out through the removable media. Thus, thedata in the removable media 123 is required to be protected from anillegal access from an external source.

FIG. 7 is a flowchart for performing the process of writing the file 107into the removable media 123 according to this embodiment. In this case,an explanation will be made about a case in which the applicationprogram 103 prepares a file 124 anew and the data of the file 107 iscopied to the file 124 thus prepared. The security level of the file 124is set by the application program 103 when the data is written in thefile 124.

In step 701, the application program 103 issues a request to write thedata of the file 107 into the file 124 in the removable media 123.

In step 702, the label management program 109 checks the security level202 of the file 107.

In step 703, whether the security level 202 of the file 107 is“confidential” or not is checked, and in the case where the securitylevel 202 is “unclassified”, the process proceeds to step 704, while inthe case where the security level is “confidential”, the processproceeds to step 706.

In the case where the security level 202 is “unclassified”, the labelmanagement program 109 issues a request to write the data other than thelabel of the file 107 into the file 124 in the removable media 123 instep 704.

In step 705, the write request is received by the file system driver104, and the data of the file 107 is transferred to the removable media123 by the disk driver 105.

In the case where the security level 202 is “confidential”, anencryption key and a decryption key are generated by the labelmanagement program 109 in step 706. The encryption key and thedecryption key may be identical to each other.

In step 707, the label management program 109 registers the decryptionkey in the key management server 114 and receives an identifier (IDnumber, for example) from the key management server 114.

In step 708, the label management program 109 encrypts the file 107using the encryption key, and prepares an encryption file. Theencryption file includes the ID number and the encrypted data. The IDnumber is added by the label management program 109 at the time ofpreparing the encryption file.

In step 709, the label management program 109 issues a request to writethe data of the encryption file into the file 124 in the removable media123, and the process proceeds to step 705.

In the case where the encrypted data in the existing file 124 isupdated, the label management program 109 transmits the ID numbercontained in the file 124 to the key management server 114, and receivesthe encryption key from the key management server 114. The labelmanagement program 109 encrypts the data using the encryption key thusreceived, and writes the encrypted data in the file 124.

FIG. 8 is a flowchart for performing the process of reading the datafrom the file 124 in the removable media 123.

In step 801, the application program 103 issues a request to the labelmanagement program 109 to read the data from the file 124 in theremovable media 123.

In step 802, the label management program 109 issues a request to thefile system driver 104 to read the data from the file 124 in theremovable media 123.

In step 803, the file system driver 104 receives the read request, andthe disk driver 105 reads the data from the file 124 in the removablemedia 123.

In step 804, the label management program 109 receives the data thusread out, and checks whether the particular data is encrypted or not.

In the case where the data is not encrypted, the process proceeds fromstep 805 to step 806, while in the case where the data is encrypted, theprocess proceeds to step 807.

In step 806, the label management program 109 delivers the data to theapplication program 103.

In step 807, the label management program 109 reads the ID number of thefile 124.

In step 808, the label management program 109 transmits the ID number ofthe file 124 to the key management server 114, and receives thedecryption key for the file 124.

In step 809, the label management program 109 decrypts the encrypteddata using the decryption key, and the process proceeds to step 806.

The data for the communication between the client terminal 101 and thekey management server 114 in step 808 may be encrypted.

In the case where the data of the file 124 on the removable media 123 iscopied or transferred to the file 107 of the magnetic disk 106 with nolabel attached to the file 124, the label management program 109attaches the label “unclassified” to the file 124 and stores it in themagnetic disk 106.

FIG. 9 is a flowchart for the application program 103 performing theprocess of transmitting the file to the network 117.

In step 901, the application program 103 issues a request to transmitthe file with a label.

In step 902, the label management program 109 acquires the securitylevel 202 of the file 107, and converts it to a request to transmit alabeled file. The application program 103 outputs an unlabeled file dataas data to be transmitted, and therefore the label management program109 converts it to a labeled file.

In step 903, the protocol driver 110 divides the labeled file intopackets, and prepares a packet header.

In step 904, the network adapter driver 111 transmits the file 107outside through a LAN controller.

Now, the security level change program 108 will be explained. Thesecurity level change program 108 is for changing the security level 202of the file 107. FIG. 10 is a flowchart for performing the process ofchanging the “confidential” file 107 to an “unclassified” file.

In step 1001, the security level change program 108 issues a request tochange the security level 202 of the file 107 from “confidential” to“unclassified”.

In step 1002, the label management program 109 acquires the settlor ID204 by reading the label of the file 107.

In step 1003, it is determined whether the settlor ID 204 acquired instep 1002 is coincident with the changer ID of the security level 202.In the case of coincidence, the process proceeds to step 1004, otherwisethe process proceeds to step 1005.

In step 1004, the label management program 109 changes the securitylevel 202 of the file 107 to “unclassified”, while at the same timechanging the settlor ID 204 and the settlor level 203.

In step 1005, it is determined whether the changer of the security level202 is authorized to change the security level 202 or not. If the answeris affirmative, the process proceeds to step 1004, otherwise the processproceeds to step 1006.

In step 1006, the label management program 109 delivers an error messageto the security level change program 108.

In step 1005, the authorization to change the security level 202 meansthe authorization to change the security level 202 forcibly. Thisauthorization can be set in such a manner that the change is possible inthe case where the level granted an authorized person intending tochange the security level 202 is higher than the settlor level 203 ofthe file 107. Also, it is possible to set the authorization in such amanner that even a person authorized to change the security level 202cannot change the security level 202 of all the files 107unconditionally but may or may not change it depending on the settlor ID204. Alternatively, the policy of the authorization to change thesecurity level 202 may be set dividedly for each organization. Theforegoing description concerns a case in which the security level 202 ischanged from “confidential” to “unclassified”. Nevertheless, three ormore security levels 202, if any, can be reduced by a similar method.

The security level change program 108 can also increase the securitylevel 202 from the “unclassified” file 107 to the “confidential” file107. Taking into consideration that the information leakage can beprevented by increasing the security level 202, an arrangement can bemade so that every person can unconditionally perform the operation ofincreasing the security level 202.

The transmission management program 119 checks the label of the file 107to be transmitted to the external network 121 by the client terminal 101and determines whether the particular file 107 is to be transmitted ornot. FIG. 11 is a flowchart for performing the process of checking thelabel.

In step 1201, the gateway server 118 receives the file 107 to betransmitted to the external network 121 from the in-house clientterminal 101.

In step 1202, the transmission management program 119 decides whether alabel is attached to the file 107 or not.

In the case where the label is so attached, the process proceeds fromstep 1203 to step 1204, otherwise the process proceeds to step 1209.

In step 1204, the transmission management program 119 checks thesecurity level 202 of the file 107.

In the case where the security level 202 of the file 107 is“unclassified”, the process proceeds from step 1205 to step 1206,otherwise the process proceeds to step 1211.

In step 1206, the transmission management program 119 removes the labelfrom the file 107.

In step 1207, the transmission management program 119 transmits the file107 outside.

In step 128, the file is transmitted successfully.

In step 1209, the transmission management program 119 determines thatthe file 107 is illegal data, and sends an error message to thetransmitter terminal and the device used by the system manager.

In step 1210, the file transmission ends in failure.

In step 1211, the transmission management program 119 sends to thetransmitter terminal a message to the effect that the security level 202of the file 107 is “confidential”.

In step 1212, the file transmission ends in failure.

In step 1206, the label is removed in order to follow the policy thatthe label can be interpreted only for other systems and terminals towhich the system according to this embodiment is introduced. Accordingto this embodiment, therefore, although the label is removed when thefile is transmitted outside, the label can otherwise be handled as longas other policies are followed.

Also, according to this embodiment, with regard to the data transmittedoutside of an organization, the label is removed after determiningwhether the data is to be transmitted to the external network 121 on thegateway server 118. Therefore, the embodiment can be utilizedtransparently also for the external network 121.

Also, the gateway server 118 is provided with a permitted transmitteelist, so that the file 107 can be transmitted to any externaltransmittee described in the permitted transmittee list even in the casewhere the security level 202 is “confidential”. In such a case, thetransmission management program 119 encrypts the file 107 and transmitsthe file 107 without removing the label. Further, the transmissionmanagement program 119 records the transmitter, the transmittee and thetransmission file in a log. The encryption key is registered in the keymanagement server 114 in the same manner as in the case where the file107 is written in the removable media. The file 107 transmitted this wayhas an ID number and the encryption data.

Now, an explanation will be given of the process performed in the casewhere the gateway server 118 receives the file 107 from the externalnetwork 121.

First, the gateway server 118 receives the file 107 transmitted towardthe client terminal 101 from the external network 121.

Then, the receiving management program 120 attaches the “unclassified”label to the file 107. Also, the settlor ID 204 is set as the ID for thegateway server 118, and the settlor level 203 is set to the lowestlevel.

After that, the receiving management program 120 transmits the file 107to the client terminal 101.

The receiving management program 120 may have the function of receivingthe labeled file 107. In such a case, the receiving management program120, after confirming that the label is attached, transmits the file 107to the client terminal 101.

The authentication can be granted each other between terminals in thein-house network 117 (between the client terminals 101 or between aclient terminal 101 and the gateway server 118). The authenticationbetween the terminals (101, 118, 114) is carried out by each terminalreferring to a list (the communication permission list) held by it,which describes the MAC (Media Access Control) addresses of theterminals with which communication is permitted by each terminal. Eachterminal can thus be controlled to carry out the communication only witha party whose MAC address (or the IP address) is found in thecommunication permission list. Alternatively, the communication betweenterminals can be permitted based not on the authentication granted byeach terminal but on the authentication determined by an authenticationserver provided for this purpose. In such a case, each terminal conductscommunication with another terminal through the authentication server.Also, the authentication between terminals may be granted using thepublic key encryption system.

Further, the authentication server may check the labels of all the filestransmitted or received by the client terminal 101 in communication withthe parties in or outside an organization. Within each organization, thefile 107 may or may not be accessible depending on the title of anemployee or the department of the organization to which the employeebelongs. Even in such a case, the information flow can be controlled bythe authentication server checking the labels.

Second Embodiment

A second embodiment of the invention will be explained. According to thefirst embodiment, a label indicating the security level 202 of the file107 is attached to the file 107. In the second embodiment, on the otherhand, the information flow is controlled using a security level controllist 1400 set in the client terminal 101 without attaching the label tothe file 107 in the client terminal 101, and in the case where the file107 is sent out of the client terminal 101, the label is attached to it.The format of the label attached to the file 107 sent out of the clientterminal 101 is similar to that for the first embodiment.

FIG. 12 shows the security level control list 1400 according to thisembodiment. The first column represents a file name 1401, the secondcolumn a security level 1402 of the file 107, the third column a settlorlevel 1403 of the file 107, and the fourth column a settlor ID 1404 ofthe file 107.

An explanation will be given of the manner in which the applicationprogram 103 accesses the file 107 in the magnetic disk 106 in thisembodiment. Unlike in the first embodiment, the file 107 according tothis embodiment is not labeled, and therefore the byte offset requestedby the application program 103 is not required to be processed. Forreading from the file 107, the label management program 109 delivers thebyte offset requested by the application program 103, directly to thefile system driver 104.

For the operation of writing into the file 107, on the other hand, thesame process as in FIG. 6 is performed except for the byte offsetprocessing. Specifically, in response to the request of the applicationprogram 103 to write into the file 107, the label management program 109checks to see whether the security level 402 of the application program103 is coincident with the security level 202 of the file 107, and inthe case of incoincidence, sets the security level 202 of the file 107forcibly to the security level 402 of the application program 103, whilein the case of coincidence, transmits the request to write into the file107 to the file system driver 104.

FIG. 13 is a flowchart for performing the process of writing data intothe file 107 of the removable media 123.

In step 1501, the application program 103 issues a request to write thedata of the file 107 into the file 124 in the removable media 123.

In step 1502, the label management program 109 checks the security level202 of the file 107.

In step 1503, whether the security level 202 is “confidential” or not isconfirmed, and in the case where the security level 202 is“unclassified”, the process proceeds to step 1504. In the case where thesecurity level 202 is “confidential”, on the other hand, the processproceeds to step 1506.

In the case where the security level 202 is “unclassified”, the labelmanagement program 109 issues a request to write the data of the file107 into the file 124 in the removable media 123 of the file 107 in step1504.

In step 1505, the file system driver 104 receives the write request, andthe disk driver 105 transfers the data of the file 107 to the removablemedia 123.

In the case where the security level 202 is “confidential”, the labelmanagement program 109 prepares a labeled file 107 in step 1506.

In step 1507, the label management program 109 generates an encryptionkey.

In step 1508, the label management program 109 registers the encryptionkey in the key management server 114 and receives an ID number from theserver.

In step 1509, the label management program 109 encrypts the labeled file107 using the encryption key thereby to prepare an encryption file. Theencryption file includes an ID number and encrypted data. The ID numberis added when the label management program 109 prepares the encryptionfile.

In step 1510, the label management program 109 issues a request to writethe data of the labeled encryption file into the file 124 of theremovable media 123, and the process proceeds to step 1505.

According to this embodiment, the data is read from the file 124 in theremovable media 123 in the same manner as in the first embodiment, asshown in FIG. 8. Also, in copying or transferring the file 123 on theremovable media 123 to the magnetic disk 106, the label managementprogram 109 adds the file name 1401, the security level 1402, thesettlor level 1403 and the settlor ID 1404 of the file 124 to thesecurity level control list 1400, and thus stores the file 124 in themagnetic disk 106.

Now, the process of transmitting the file at the client terminal 101according to this embodiment will be explained with reference to FIG. 9.

In step 901, the application program 103 issues a request to transmitthe file 107. According to this embodiment, prior to proceeding to step902, a step is added for the label management program 109 to acquire thesecurity level 202 of the file 107 and thereby to prepare a labeledfile. The subsequent process is similar to that of the first embodiment,so that the process proceeds to step 902, in which the label managementprogram 109 converts the transmission request of the file 107 to thetransmission request of the labeled file 107.

In step 903, the protocol driver 110 divides the packet and prepares apacket header.

In step 904, the network adapter driver 111 transmits the file 107outside through a LAN controller.

Upon generation of a request to delete the file 107, the labelmanagement program 109 transmits a request to delete the file 107 to thefile system driver 104, and after receiving from the file system driver104 a message to the effect that the file 107 has been successfullydeleted, deletes the row of the file 107 from the security level controllist 1400.

Upon receipt of the file 107 from another client terminal 101 or thegateway server 118, the label management program 109 checks the labelattached to the head of the file 107 and registers the label informationof the file 107 in the security level control list 1400. After that, thelabel management program 109 delivers the file 107 to the applicationprogram 103.

The security level 202 of the file 107 is changed in such a manner thatthe label management program 109 receives a request to change thesecurity level 202 of the file 107 from the security level changeprogram 108 and then changes the security level control list 1400.Specifically, the processing flow shown in FIG. 10 is followed exceptthat the security level control list 1400 is used.

According to the first or second embodiment, the security level 202 isset in the file 107 and thereby the information flow can be controlledin the network.

Third Embodiment

Now, an explanation will be given of a third embodiment capable ofguaranteeing the legitimacy of the label and preventing the illegalalteration of the label.

According to this embodiment, it is possible to prevent the illegal actin which a third party alters a label illegally and thus hides a personwho has actually altered the label. As a specific example, an illegalact can be prevented in which a third party A alters a label illegallyfrom the file 107 labeled “confidential” to a file labeled“unclassified”, and further sets the settlor ID to the ID of anotherperson B to show as if B has changed the security level. In this way,should the file 107 labeled “confidential” leak outside, the innocent Bis prevented from being persecuted for the act.

FIG. 14 is a diagram showing a structure of the labeled file 107 used inthis embodiment. The labeled file 107 includes a label 1701 at the headthereof, followed by a data hash value 1702, a label signature 1703, afile data 1704 and a link signature 1705.

The data hash value 1702 is that of the file data as of the time pointwhen the settlor himself of the security level 202 prepares or correctsthe file 107 or changes the security level 202. The label signature 1703is a digital signature attached by the settlor of the security level 202for the label 1701 and the data hash value 1702. The link signature1705, on the other hand, is a digital signature attached by the personwho has prepared or changed the file data 1704 for the label 1701 andthe file data 1704.

The label signature 1703 guarantees the legitimacy of the label 1701,while the link signature 1705 guarantees the legitimacy of the file data1704 and the legitimacy of the link between the file data 1704 and thelabel 1701. The use of the label signature 1703 and the link signature1705 is effective for the investigation as to where the responsibilitylies for any information leakage which may occur, while at the same timesuppressing the illegal information leakage as the evidence is left. Adifferent confidential key for the signature is desirably held by eachdifferent user.

This embodiment can be used as an extension of the first embodiment, inwhich case the file structure described above is used in and outside theclient terminal 101. In the case where this embodiment is used as anextension of the second embodiment, on the other hand, the filestructure is used outside the client terminal 101, while the column ofthe data hash value 1702, the label signature 1703 and the linksignature 1705 is added to the security level control list 1400 withinthe client terminal 101, thereby assuring the legitimacy of the labelinformation.

Now, this embodiment will be explained as an extension of the secondembodiment of the invention.

FIG. 15 is a flowchart for performing the process of writing data (filedata 1704) into the file 107 according to this embodiment.

In step 1801, the application program 103 issues a request to write thedata (file data 1704) into the file 107.

In step 1802, the label management program 109 checks, with reference tothe process management list 400 and the security level control list1400, whether the security level 402 of the application program 103coincides with the security level 202 of the file 107.

In the case where the security level 202 of the application program 103coincides with that of the file 107 in step 1803, the process proceedsto step 1806, otherwise the process proceeds to step 1804.

In step 1804, the label management program 109 changes the securitylevel 202 of the file 107 to the security level 402 of the applicationprogram 103, and further changes the settlor level 203 and the settlorID 204. In step 1805, the label management program 109 newly determinesthe data hash value 1702, the label signature 1703 and the linksignature 1705, and then proceeds to step 1808. Under this condition,the data hash value 1702 is that of the file data 1704 after the change,and the label signature 1703 and the link signature 1705 the signatureof the party requesting to write into the file 107.

In step 1806, the label management program 109 checks whether thesettlor of the security level 202 of the file 107 coincides with theparty requesting to write into the file 107, and in case of coincidence,the process proceeds to step 1805, otherwise the process proceeds tostep 1807.

In step 1807, the label management program 109 newly determines the linksignature 1705, which is the signature of the party requesting to writeinto the file 107.

In step 1808, the label management program 109 issues a request to thefile system driver 104 to write the newly acquired one of the data hashvalue 1702, the label signature 1703 and the link signature 1705together with the file data 1704 into the file 107.

In step 1809, the file system driver transmits the data to be writteninto the particular file, to the disk driver, which in turn writes thedata in the magnetic disk.

An explanation will be made about the process performed at the clientterminal 101 for transmitting the labeled file 107. First, the labelmanagement program 109 receives a file transmission request from theapplication program 103. Then, the label management program 109 convertsthe file transmission request from the application program 103 to thetransmission request for the labeled file 107. Specifically, the filestructure transmitted from the client terminal 101 is identical to thestructure shown in FIG. 14.

FIG. 16 is a flowchart showing the process for performing the filereceive operation at the client terminal 101 according to thisembodiment.

In step 1901, the label management program 109 receives the labeled file107.

In step 1902, the label management program 109 checks the label 1701 ofthe labeled file 107. In the process, the label management program 109verifies the legitimacy of the label 1701 based on the label signature1703, and checks for the completeness of the file data 1704 and thelegitimacy of the link between the file data 1704 and the label 1701based on the link signature 1705.

From step 1903, the process proceeds to step 1904 in the case where theresult of the check in step 1902 shows that the label 1701, the filedata 1704 and the link between the file data 1704 and the label 1701 arecorrect, otherwise the process proceeds to step 1906.

In step 1904, the label management program 109 adds the labelinformation of the labeled file 107 to the security level control list1400.

In step 1905, the label management program 109 delivers the labeled file107 to the application program 103.

In step 1906, the label management program 109 transmits the labelinformation of the labeled file 107 to the manager.

In step 1907, the label management program 109 sends an error message tothe application program 103.

Now, the process performed for changing the “confidential” labeled file107 to an “unclassified” file according to this embodiment will beexplained with reference to FIG. 10.

In step 1001, the security level change program 108 issues a request tochange the security level 202 of the labeled file 107 from“confidential” to “unclassified”.

In step 1002, the label management program 109 acquires the settlor ID204 of the labeled file 107 from the security level control list 1400according to this embodiment.

In step 1003, it is determined whether the settlor ID 204 acquired instep 1002 is coincident with the changer ID of the security level 202.In the case of coincidence, the process proceeds to step 1004, otherwisethe process proceeds to step 1005.

In step 1004, the label management program 109 changes the securitylevel 202 of the labeled file 107 to “unclassified”, while at the sametime changing the settlor ID 204 and the settlor level 203. According tothis embodiment, the label management program 109 further performs theprocess for newly acquiring the label signature 1703 and the linksignature 1705.

The process including and subsequent to step 1005 is similar to that ofthe first embodiment. In step 1005, it is determined whether the changerof the security level 202 is authorized to change the security level 202or not. In the case where the changer is so authorized, the processproceeds to step 1004, otherwise the process proceeds to step 1006.

In step 1006, the label management program 109 delivers an error messageto the security level change program 108.

This embodiment is described above referring to a case in which thesecurity level 202 is changed from “confidential” to “unclassified”.Nevertheless, the security level 202 can be reduced by the same methodalso in the case where the security level 202 includes three levels.

FIG. 17 is a flowchart for performing the process of checking the label1701 at the gateway server 118 according to this embodiment.

In step 2101, the file 107 transmitted outside of the in-house clientterminal 101 is received.

In step 2102, the transmission management program 119 checks whether thelabel 1701 for the file 107 is present or not.

In step 2103, the process proceeds from step 2103 to step 2104 in thepresence of the label 1701, otherwise the process proceeds to step 2111.

In step 2104, the transmission management program 119 checks thesecurity level 202 of the labeled file 107.

In step 2105, the process proceeds to step 2106 if the security level202 is “unclassified”, otherwise the process proceeds to step 2113.

In step 2106, the transmission management program 119 checks whether thelabel 1701 is complete or not. In the process, the transmissionmanagement program 119 verifies the legitimacy of the label 1701 basedon the label signature 1703, and checks both the completeness of thefile data 1704 and the legitimacy of the linkage between the file data1704 and the label 1701 based on the link signature 1705.

From step 2107, the process proceeds to step 2108 in the case where thecheck in step 2106 shows that the linkage is legitimate, otherwise theprocess proceeds to step 2115.

In step 2108, the transmission management program 119 removes the label1701, the data hash value 1702, the label signature 1703 and the linksignature 1705 from the labeled file 107.

In step 2109, the transmission management program 119 transmits the file107 outside.

In step 2110, the file is transmitted successfully.

In step 2111, the transmission management program 119 determines thatthe file 107 is illegal data, and sends an error message to thetransmitter terminal.

In step 2112, the file transmission ends in failure.

In step 2113, the transmission management program 119 sends to thetransmitter terminal a message to the effect that the security level 202of the labeled file 107 is not “unclassified”.

In step 2114, the file transmission ends in failure.

In step 2115, transmission management program 119 sends to thetransmitter terminal a message to the effect that the label of thelabeled file 107 is illegal.

In step 2116, the file transmission ends in a failure.

Also, the transmission management program 119 may store all the contentsof the transmitter information and the transmittee information and thetransmission file (the file having the label 1701, the data hash value1702, the label signature 1703 and the link signature 1705) in a log.

According to this embodiment, in the case where the gateway server 118receives the file 107 transmitted toward the client terminal 101 fromthe external network 121, the receiving management program 120 attachesthe “unclassified” label to the file 107 and transmits the file 107 tothe client terminal 101. In this case, the label settlor ID 204 is setto the ID of the gateway server 118, and the settlor level 203 is set tothe lowest level. Also, the label signature 1703 and the link signature1705 constitute the signature by the gateway server 118.

Further, the receiving management program 120 may store in a log thetransmitter information, the transmittee information of the file 107 andall the contents of the received file.

Fourth Embodiment

A fourth embodiment of the invention will be explained.

Various application programs 103 operate on a general-purpose computer.Also, various devices are connected and therefore the device drivers foroperating these devices are in operation. As a result, in the case whereeach of the embodiments described above is implemented with ageneral-purpose computer, a bug of the application program 103 or thedevice driver and the operating error of the user may cause a change ora deletion of the label information (the security level control list1400), the label management program 109 and the process management list400. According to this embodiment, such an inconvenience can be avoided.

FIG. 18 shows an example of a configuration of the client terminal 101according to this embodiment. By replacing this client terminal with theclient terminal 101 shown in FIG. 1 and using each of the embodimentsdescribed above, the aforementioned effect of this embodiment can beachieved.

Two operating systems are working in the client terminal 101, which hasa memory area 2201 managed by the first operating system and a memoryarea 2202 managed by the second operating system. Further, a multi OScontrol programs 2204 for controlling the two operating systems are inoperation. A multi OS control technique is disclosed in JP-A-11-149385.

Also, the memory area 2201 managed by the first operating system hasloaded therein an application program 103, a security level changeprogram 108, an I/O hook program 2203, a file system driver 104, a diskdriver 105, a protocol driver 110 and a network adapter driver 111.Further, the first operating system manages the magnetic disk 106 andthe network I/F 112, and the file 107 is stored in the magnetic disk106.

The label management program 109 and the process management list 400 arestored in the memory area 2202 managed by the second operating system.Also, the second operating system manages the magnetic disk 2205, whichhas stored therein the security level control list 1400.

The I/O hook program 2203 hooks the request for access to the file 107from the application program 103 or the security level change program108 or the request for transmission/receiving of the file 107. Further,the I/O hook program 2203 has the function of requesting the processingof the label management program 109 and the function of receiving theresult of processing of the label management program 109 and deliveringthe result of the processing to the file system driver 104 or theprotocol driver 110. Specifically, the I/O hook program 2203 requeststhe processing of the label management program 109 utilizing thefunction of communication between the operating systems of a multi OScontrol programs 2204. The function of communication between theoperating systems is disclosed, for example, in JP-A-11-85546.

According to this embodiment, the objects to be protected (labelmanagement program 109, the process management list 400 and the securitylevel control list 1400) are managed by the second operating system, sothat protection is possible from the change due to the bug of theapplication program 103 or the device driver operating on the firstoperating system or the operating error of the user.

Miscellaneous

According to each of the embodiments described above, not only theleakage of the in-house confidential information is prevented but alsothe leakage of the confidential information which otherwise might becaused by the illegal intrusion through the external network 121 can beprevented. In the case where an illegal intruder attempts to take away aconfidential file from the client terminal 101 through the gatewayserver 118, the transmission management program 119 of the gatewayserver 118 checks the label of the particular confidential file. In thecase where the security level is “confidential”, the transmissionmanagement program 119 rejects the transmission outside and thereforethe leakage of the confidential file can be prevented.

Also, the label management program 109 can attach a label “Untrusted” onan untrusted program (such as a program accompanying the mail) therebyto limit the files accessible.

Specifically, the “Untrusted” label is attached on a system file or aset information file of the kernel, so that in the case where the“Untrusted” program accesses a “Trusted” file, the label managementprogram 109 limits the access. This function can be realized by thelabel management program 109 checking the program and the file labelwhen the file is open. By use of this function, the effect that acomputer virus has on the system can be minimized.

Also, communication can be carried out between the client terminal 101and the gateway server 118 by use of a dedicated communication protocol.As a result, a label is attached on the header area of each packet, andthe transmission management program 119 of the gateway server 118 checksthe label in the header area of the packet thereby to determine whetherthe data can be transmitted or not. In the case where the dedicatedcommunication protocol is used for transmission of data to the externalnetwork 121, the transmission management program 119 removes the labeland converts it into a general-purpose communication protocol (TCP/IP,etc.).

Also, the labeled file 107 is attached to the file attached to theelectronic mail and transmitted, and the gateway server 121 checks thelabel of the file accompanying the mail, thereby making it possible toprevent the confidential file from leaking outside through electronicmail. As for the text of the mail, the leakage can be prevented bychecking, using the keyword search, to see whether any keyword againstthe policy is included or not.

Also, a security level is set for each client terminal 101, and furtheran intermediate server is provided between the client terminals 101 onthe one hand and between each client terminal 101 and each server on theother, so that the intermediate server may be equipped with the functionof preventing the leakage of the information. In this case, the labelneed not be attached to the file 107 on the client terminal 101.

In this case, the intermediate server manages the security level of eachclient terminal 101, and determines whether the file 107 transmitted bythe client terminal 101 is allowed to be transmitted to another clientterminal 101 or another department or group. No label is attached in thecase where the intermediate server transmits the file 107 directly tothe client terminal 101, but the label is attached in the case where thefile 107 is transmitted to the intermediate server of another departmentor group. The intermediate server checks the label of the file 107received from another intermediate server, and when transmitting thefile 107 to the client terminal 101, removes the label. The intermediateserver may be arranged for each department or group.

By doing so, the label management program 109 is not required to beincorporated in each client terminal 107, thereby making it possible tosave the labor and trouble for introducing the function of informationleakage prevention.

Thus, there is provided a system capable of preventing the leakage of aconfidential file having an arbitrary format.

It should be further understood by those skilled in the art that theforegoing description has been made on embodiments of the invention andthat various changes and modifications may be made in the inventionwithout departing from the spirit of the invention and the scope of theappended claims.

1. A network system connected to an in-house network and capable ofcontrolling transmission, comprising a transmission/receiving terminalhaving means for transmitting/receiving data and repeater means forrelaying the data transmitted/received between saidtransmission/receiving terminal and said in-house network, wherein: saiddata includes information proper and additional information associatedwith said information proper; said repeater means includes means forcontrolling the data transmission from said transmission/receivingterminal using said additional information, and means for removing saidadditional information from data transmissible outside of said in-housenetwork; and said repeater means includes: a transmission permit list oftransmittees external to said in-house network to which saidtransmission/receiving terminal is permitted to transmit data; means forencrypting the data to be transmitted by said transmission/receivingterminal; means for receiving the data to be transmitted by saidtransmission/receiving terminal; means for determining whether said datais to be transmitted, with reference to said transmission permit list;means for encrypting said data of which the transmission is permitted;and means for transmitting said encrypted data outside of said in-housenetwork.
 2. A network system connected to an in-house network andcapable of controlling transmission, comprising a transmission/receivingterminal having means for transmitting/receiving data and repeater meansfor relaying the data transmitted/received between saidtransmission/receiving terminal and said in-house network, wherein: saiddata includes information proper and additional information associatedwith said information proper; said repeater means includes means forcontrolling the data transmission from said transmission/receivingterminal using said additional information, and means for removing saidadditional information from data transmissible outside of said in-housenetwork; and said additional information includes informationrepresenting a security level of said information proper, a featurevalue of said information proper, a first digital signature for theinformation indicating said security level and said feature value, and asecond digital value for the information indicating said security leveland said information proper.
 3. A network system connected to anin-house network and capable of controlling transmission, comprising atransmission/receiving terminal having means for transmitting/receivingdata and repeater means for relaying the data transmitted/receivedbetween said transmission/receiving terminal and said in-house network;wherein: said data includes information proper and additionalinformation associated with said information proper; said repeater meansincludes means for controlling the data transmission from saidtransmission/receiving terminal using said additional information, andmeans for removing said additional information from data transmissibleoutside of said in-house network; said transmission/receiving terminalincludes a first operating system, a second operating system and a multiOS control program, said program controlling said first and secondoperating systems; said first operating system manages the applicationprogram handling said information proper; and said second operatingsystem manages means for controlling access to said information properusing said additional information, and means for changing saidadditional information.
 4. A network system capable of controllingtransmission, comprising: an information processing system including afirst storage unit, a second storage unit for reading/writing data fromand into removable media, means for accessing said first and secondstorage units, and an additional information list containing additionalinformation to be added to each information proper; and a key managementunit for managing an encryption key; wherein: said access means includesmeans for recording the information proper from said first storage unitinto said second storage unit; and said recording means includes meansfor determining whether said data is to be encrypted or not, byreferring to the additional information of said information properrecorded in said additional information list, means for generating anencryption key in the case where said data can be encrypted, means forencrypting said data using said encryption key, means for registeringsaid encryption key in said key management unit, means for receiving anidentifier of said registered encryption key from said key managementunit, means for generating data by adding said additional information tosaid information proper, and means for recording said encrypted data andsaid identifier in said second storage unit using said encryption key.5. A network system capable of controlling transmission, comprising: aninformation processing system including a first storage unit, a secondstorage unit for reading/writing data from and into removable media,means for accessing said first and second storage units, and anadditional information list containing additional information to beadded to each of said information proper; and a key management unit formanaging an encryption key; wherein: said access means includes meansfor recording the data from said second storage unit into said firststorage unit; said data includes an identifier and encrypted data; saidencrypted data includes an additional information section; saidrecording means includes means for transmitting said identifier to saidkey management unit and receiving the encryption key for a correspondingone of said encrypted data, means for decrypting said encrypted datausing said encryption key, and means for adding said additionalinformation to said additional information list; and said key managementunit includes means for receiving said identifier from said recordingmeans and transmitting the encryption key associated with said encrypteddata to said recording means.
 6. A network system capable of controllingtransmission, comprising: an information processing system including afirst storage unit, a second storage unit for reading/writing data fromand into removable media, and means for accessing said first and secondstorage units; and a key management unit for managing an encryption key;wherein: said access means includes means for recording the data fromsaid first storage unit into said second storage unit; said dataincludes information proper and additional information associated withsaid information proper; said recording means includes means fordetermining whether said data is to be encrypted or not, based on saidadditional information, means for generating an encryption key, meansfor encrypting said data using said encryption key, means forregistering said encryption key in said key management unit, means forreceiving an identifier of said registered encryption key from said keymanagement unit, and means for recording said encrypted data and saididentifier into said second storage unit; and said key management unitincludes means for receiving said encryption key from said recordingmeans and transmitting said identifier associated with said encryptionkey to said recording means.
 7. A network system capable of controllingtransmission, comprising: an information processing system including afirst storage unit, a second storage unit for reading/writing data fromand into removable media, and means for accessing said first and secondstorage units; and a key management unit for managing an encryption key;wherein: said access means includes means for recording the data fromsaid second storage unit into said first storage unit; said dataincludes an identifier and encrypted data; said recording means includesmeans for transmitting said identifier to said key management unit andreceiving the encryption key for said encrypted data, and means fordecrypting said encrypted data using said encryption key; and said keymanagement unit includes means for receiving said identifier from saidrecording means and transmitting said encryption key associated withsaid encrypted data to said recording means.
 8. A network systemconnected to an in-house network and capable of controllingtransmission, comprising a transmission/receiving terminal having meansfor transmitting/receiving data and repeater means for relaying the datatransmitted/received between said transmission/receiving terminal andsaid in-house network, wherein: said data includes information properand additional information associated with said information proper; andsaid repeater means includes means for controlling the data transmissionfrom said transmission/receiving terminal using said additionalinformation, and means for removing said additional information fromdata transmissible outside of said in-house network; said additionalinformation includes information representing an attribute of saidinformation proper; said repeater means includes means for holding atransmission policy corresponding to said attribute, and means fordetermining whether the data to be transmitted by said transmissionterminal can be transmitted in accordance with said transmission policy;said attribute is a security level; said additional information furtherincludes settler information for said security level and hierarchicalinformation of the settler; said transmission/receiving terminalincludes means for changing said additional information; and said changemeans determines whether the security level of said data can be changed,with reference to the security level of the data of said additionalinformation, the settlor information of said security level, thehierarchical information of said settlor, changer information of aperson intending to change the additional information of said data andhierarchical information of said changer.